Skip to content

[Snyk] Fix for 6 vulnerabilities #10493

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
q1blue wants to merge 1 commit into from
Closed

[Snyk] Fix for 6 vulnerabilities #10493

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions plugins/kafka-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,16 +35,16 @@
"clean": "backstage-cli package clean"
},
"dependencies": {
"@backstage/backend-common": "workspace:^",
"@backstage/backend-plugin-api": "workspace:^",
"@backstage/catalog-model": "workspace:^",
"@backstage/config": "workspace:^",
"@backstage/backend-common": "0.25.0",
"@backstage/backend-plugin-api": "1.6.1",
"@backstage/catalog-model": "0.1.1",
"@backstage/config": "0.1.1",
Comment on lines +38 to +41
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jan 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Automated dependency updates have incorrectly replaced workspace:^ with pinned versions for these internal @backstage packages. In a monorepo using Yarn workspaces, this is incorrect and can lead to multiple versions of the same package being installed, causing inconsistencies and potential build failures.

The correct approach is to update the versions of these packages in the root package.json of the monorepo. This ensures that all packages in the workspace use the same, updated version. Please revert these lines to use workspace:^ and perform the version upgrades at the repository root.

Suggested change
"@backstage/backend-common": "0.25.0",
"@backstage/backend-plugin-api": "1.6.1",
"@backstage/catalog-model": "0.1.1",
"@backstage/config": "0.1.1",
"@backstage/backend-common": "workspace:^",
"@backstage/backend-plugin-api": "workspace:^",
"@backstage/catalog-model": "workspace:^",
"@backstage/config": "workspace:^",

"@backstage/errors": "workspace:^",
"@types/express": "^4.17.6",
"express": "^4.17.1",
"express-promise-router": "^4.1.0",
"kafkajs": "^2.0.0",
"lodash": "^4.17.21",
"lodash": "^4.17.23",
"winston": "^3.2.1"
},
"devDependencies": {
Comment on lines 35 to 50
Copy link
Copy Markdown

@entelligence-ai-pr-reviews entelligence-ai-pr-reviews Bot Jan 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correctness: lodash ^4.17.23 does not exist (latest is 4.17.21). This will cause npm install to fail. Change to ^4.17.21.

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

File: plugins/kafka-backend/package.json, Line 45

Problem: The lodash dependency is set to version ^4.17.23, which does not exist in the npm registry. The latest stable version of lodash is 4.17.21.

Fix Instructions:
1. Change the lodash version from "^4.17.23" to "^4.17.21" in the dependencies section
2. Run `npm install` or `yarn install` to update the lockfile
3. Verify the installation completes successfully
4. Consider running `npm audit` or `yarn audit` to check for any remaining security vulnerabilities
✨ Committable Code Suggestion

💡 This is a one-click fix! Click "Commit suggestion" to apply this change directly to your branch.

Suggested change
"clean": "backstage-cli package clean"
},
"dependencies": {
"@backstage/backend-common": "workspace:^",
"@backstage/backend-plugin-api": "workspace:^",
"@backstage/catalog-model": "workspace:^",
"@backstage/config": "workspace:^",
"@backstage/backend-common": "0.25.0",
"@backstage/backend-plugin-api": "1.6.1",
"@backstage/catalog-model": "0.1.1",
"@backstage/config": "0.1.1",
"@backstage/errors": "workspace:^",
"@types/express": "^4.17.6",
"express": "^4.17.1",
"express-promise-router": "^4.1.0",
"kafkajs": "^2.0.0",
"lodash": "^4.17.21",
"lodash": "^4.17.23",
"winston": "^3.2.1"
},
"devDependencies": {
"postpack": "backstage-cli package postpack",
"clean": "backstage-cli package clean"
},
"dependencies": {
"@backstage/backend-common": "0.25.0",
"@backstage/backend-plugin-api": "1.6.1",
"@backstage/catalog-model": "0.1.1",
"@backstage/config": "0.1.1",
"@backstage/errors": "workspace:^",
"@types/express": "^4.17.6",
"express": "^4.17.1",
"express-promise-router": "^4.1.0",
"kafkajs": "^2.0.0",
"lodash": "^4.17.21",
"winston": "^3.2.1"
},
"devDependencies": {

Expand Down
Loading